Trusts
Requires the ad-trust module. The Trusts page shows and fine-tunes an established AD trust: trust type, trusted domains, UPN suffixes, SID blocklists; NetBIOS name and fallback primary group in the global config. Creating the trust is CLI work.
Requires the ad-trust module. The Trusts page lists trusts established with AD forests, one entry per forest root domain. Creating, verifying and removing a trust is CLI (ipa trust-add / trust-fetch-domains / trust-del), see AD trust prerequisites; this page is for state and details.
Trust detail
| Field | Meaning |
|---|---|
| Realm name | DNS name of the AD forest root |
| Domain NetBIOS name | AD's short name, the DOMAIN in DOMAIN\user |
| Trust type | Active Directory domain, the only supported type |
| Trust direction | one-way (IPA trusts AD, AD users log in to Linux) or two-way. One-way is what 1.0.2 was validated with |
| Alternative UPN suffixes | when AD logins carry a suffix other than the domain (user@corp.com while the domain is ad.corp.local), list corp.com here or sssd cannot tell which trusted domain the user belongs to |
| SID blocklists (incoming / outgoing) | SIDs ignored when they appear in the PAC of an AD user's ticket. The default list is Windows' well-known SIDs (S-1-5-*); do not empty it |
The Trusted domains tab lists the child domains discovered in the forest, each with its own enable / disable; a disabled child's users cannot log in to Linux. A new child domain in the forest appears only after ipa trust-fetch-domains <forest>.
Trusts global config
| Field | Meaning |
|---|---|
| Domain / Security identifier / NetBIOS name / Domain GUID | the IPA domain's own identity as a "Windows domain", generated by ipa-adtrust-install. The NetBIOS name is the IPA short name AD sees |
| Fallback primary group | the group given to AD users on Linux when their AD primary group has no mapping; shipped as Default SMB Group. Never point it at a privileged group such as admins |
| IPA AD trust agents / trust controllers | which IPA servers handle the trust: controllers run Samba and can create trusts, agents only resolve AD users. A replica becomes an agent through ipa-adtrust-install --add-agents |
Is the trust alive
ipa trust-show ad.ipa.test
ipa trust-fetch-domains ad.ipa.test # also refreshes the child domain list
id jdoe@ad.ipa.test # resolve an AD user on any IPA server
getent group 'linux-admins@ad.ipa.test'If id fails while trust-show is fine, check sssd's domain/linux.ipa.test log on the IPA server and the DNS forward zone.
Boundaries
- The ID range type of the trust (
ipa-ad-trust, computed; oripa-ad-trust-posix, reading AD's POSIX attributes) is fixed at creation; see ID ranges. - IPA users cannot log in to Windows through the trust; a one-way trust serves AD users on Linux only.
- An expired licence does not break the trust; AD users keep logging in, only this page goes read-only.
Role-based access control (RBAC)
Delegating administration: the permission → privilege → role layers, what the shipped roles can do, giving a help desk a reset-password-only account, and how the admins group relates to RBAC.
ID ranges
How the local range and each trusted domain's range decide uid / gid, what the range types mean, how an AD user's uid is derived from its SID, and why a range cannot simply be edited later.